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- The MAILING DATE of this communication appears on the cover sheet with the correspondence address - 



Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .1 36(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

1 )^ Responsive to communication(s) filed on 08 May 2001 . 
2a)D This action is FINAL. 2b)^ This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 

Disposition of Claims 

4) ^ Claim(s) 1-24 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) E3 Claim(s) 1-24 is/are rejected. 

7) D Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner. 

10)D The drawing(s) filed on is/are: a)D accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 

Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 
1 1 )□ The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-1 52. 

Priority under 35 U.S.C. § 119 

12)D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 
a)D All b)D Some * c)D None of: 

Certified copies of the priority documents have been received. 

2.Q Certified copies of the priority documents have been received in Application No. . 

3-D Copies of the certified copies of the priority documents have been received in this National Stage 
application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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DETAILED ACTION 

STATUS 

Claims 1-24 have been examined. 

Claim Rejections - 35 USC §101 
35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or 
any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and 
requirements of this title. 

Claims 1 and 12 are rejected under 35 U.S.C. 101 because the claimed invention is 
directed to non-statutory subject matter. In claims 1 and 12 the applicant claims a method for 
creating policy groups, moving a data element between groups and generating a privacy policy 
based upon the policy group. This process might be performed without the aid of any 
technology and therefore the claimed method is not within the technological arts. 

All that is necessary to make a sequence of operational steps in a statutory process within 
35 U.S.C. 101 is that it be in the technological arts so as to be in concordance with the 
Constitutional purpose to promote the progress of "useful arts" In re Musgrave, 431 F.2d 882 
167 USPQ 280 (CCPA 1970) 

A claim is limited to a practical application when the method, as claimed, produces a 
concrete, tangible and useful result: i.e. the method recites a step or act of producing something 
that is concrete, tangible and useful. See AT&T v. Excel Communications Inc., 172 F3d at 1358, 
50 USPQ2dat 1452. 

Claims 2-1 1 and 13-22 are dependant on rejected claim 1 and 12 respectively , and are 
rejected for at least the same reasons. 

Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

Claims 1- 24 are rejected under 35 U.S.C. 103(a) as being unpatentable over Moriconi et 
al (US Patent 6,158,010) in view of Abraham et al. (WO 98/40987). 

As per claim 1 , 
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Moriconi et al ('010) discloses a method for creating a privacy policy, comprising: 

moving a data element to the policy group;(Figure 9) 

generating a privacy policy based on the policy group. (Figure 4) 

Moriconi et al ('010) does not explicitly disclose creating a policy group, Abraham et al. 
('987) discloses creating a policy group.(Abstract) It would have been obvious to one having 
ordinary skill in the art at the time the invention was made to combine the Moriconi et al ('OlO)'s 
method with the Abraham et al. ('987)'s method in order to secure management of a computer 
network 

As per claim 2, 

Moriconi et al ('010) discloses the method of claim 1, 

wherein the data element is a predefined data element.(Column 6, lines 20-26) 
As per claim 3, 

Moriconi et al ('010) discloses the method of claim 1, 

wherein the data element comprises at least one sub-element.(Column 6, lines 46-51) 
As per claim 4, 

Moriconi et al ('010) discloses the method of claim 1, further comprising: 
updating a policy-wide property; and generating the privacy policy based on the policy- 
wide property. (Column 5, lines 48-55) 

As per claim 5, 

Moriconi et al ('010) discloses the method of claim 1, 

wherein the step of generating a privacy policy comprises generating a human readable 
version of the policy.(Column 9, lines 45-50 - Examiner notes that although Moriconi et al does 
not specifically disclose "generating a human readable version of the policy" it would be obvious 
that if the policy is manipulated via a GUI it would be readable to the user.) 

As per claim 6, 

Moriconi et al ('010) discloses the method of claim 5, 

Official Notice is taken that "hypertext markup language version of the policy" is 
common and well known in prior art in reference to policy management. It would have been 
obvious to one having ordinary skill in the art at the time the invention was made to render the 
policy in HTML format in order to provide a format that is universally viewable across a wide 
variety of computer platforms and operating systems. 

As per claim 7, 

Moriconi et al ('010) discloses the method of claim 1, 

Official Notice is taken that "generating an extensible markup language version of the 
policy" is common and well known in prior art in reference to policy management. It would 
have been obvious to one having ordinary skill in the art at the time the invention was made to 
render the policy in XML format in order to provide a format that is universally viewable across 
a wide variety of computer platforms and operating systems. 
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As per claim 8, 

Moriconi et al ('010) discloses the method of claim 1, 

wherein the step of generating a privacy policy comprises generating a compact 
policy.(Figure 4 - note element 436 optimizer) 

As per claim 9, 

Moriconi et al ( c 010) discloses the method of claim 1, 
- wherein the step of generating a privacy policy comprises generating a policy statement 
corresponding to the policy group. (Figure 4) 

As per claim 10, 

Moriconi et al ('010) discloses the method of claim 9, 

wherein the step of generating a privacy policy further comprises generating a table of 
policy elements, wherein a policy element in the table of policy elements corresponds to the 
policy statement. (Column 4, lines 34-37 — the rules [i.e. elements] are stored in a database [i.e. 
table]) 

As per claim 11, 

Moriconi et al ( c 010) discloses the method of claim 1, further comprising: 
identifying an error in the privacy policy ;(Column 11, lines 44-46 - Although Moricini 
does not specifically disclose generating an error statement describing the error he does disclose 
generating a log file, it is well known within modern computing systems to automate the 
generation of error reports from log files) 

As per claim 12, 

Moriconi et al ('010) discloses an apparatus for creating a privacy policy, comprising: 
movement means for moving a data element to the policy group;(Figure 9) 
generation means for generating a privacy policy based on the policy group. (Figure 4) 
Moriconi et al ( c 010) does not explicitly disclose creation means for creating a policy 
group, Abraham et al. ('987) discloses creation means for creating a policy group.(Abstract) It 
would have been obvious to one having ordinary skill in the art at the time the invention was 
made to combine the Moriconi et al ('OlO)'s apparatus with the Abraham et al. ('987)'s 
apparatus in order to secure management of a computer network 

As per claim 13, 

Moriconi et al ('010) discloses the apparatus of claim 12, 

wherein the data element is a predefined data element.(Column 6, lines 20-26) 

As per claim 14, 

Moriconi et al ('010) discloses the the apparatus of claim 12, 

wherein the data element comprises at least one sub-element. (Column 6, lines 46-51) 



As per claim 15, 
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Moriconi et al ('010) discloses the apparatus of claim 12, further comprising: 
means for updating a policy- wide property; and means for generating the privacy policy based on 
the policy-wide property. (Column 5, lines 48-55) 

As per claim 16, 

Moriconi et al ( c 010) discloses the apparatus of claim 12, 
wherein the generation means comprises means for generating a human 
readable version of the policy.(Column 9, lines 45-50 - Examiner notes that although Moriconi 
et al does not specifically disclose "generating a human readable version of the policy" it would 
be obvious that if the policy is manipulated via a GUI it would be readable to the user.) 

As per claim 1 7 

Moriconi et al ('010) discloses the apparatus of claim 16, 

Official Notice is taken that "hypertext markup language version of the policy" is 
common and well known in prior art in reference to policy management. It would have been 
obvious to one having ordinary skill in the art at the time the invention was made to render the 
policy in HTML format in order to provide a format that is universally viewable across a wide 
variety of computer platforms and operating systems. 

As per claim 1 8 

Moriconi et al ('010) discloses the apparatus of claim 19, 

Official Notice is taken that "generating an extensible markup language version of the 
policy" is common and well known in prior art in reference to policy management. It would 
have been obvious to one having ordinary skill in the art at the time the invention was made to 
render the policy in XML format in order to provide a format that is universally viewable across 
a wide variety of computer platforms and operating systems. 

As per claim 19, 

Moriconi et al ('010) discloses the apparatus of claim 12, 

wherein the generation means comprises means for generating a compact policy.(Figure 4 
- note element 436 optimizer) 

As per claim 20, 

Moriconi et al ('010) discloses the apparatus of claim 12, 
wherein the generation means comprises means for generating a policy statement corresponding 
to the policy group.(Figure 4) 

As per claim 21 

Moriconi et al ('010) discloses the apparatus of claim 20, 

wherein the generation means further comprises means for generating a table of policy 
elements, wherein a policy element in the table of policy elements corresponds to the policy 
statement.(Column 4, lines 34-37 — the rules [i.e. elements] are stored in a database [i.e. table]) 
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As per claim 22, 

Moriconi et al ( c 010) discloses the apparatus of claim 12, further comprising: means for 
identifying an error in the privacy policy ;(Column 11, lines 44-46 - Although Moricini does not 
specifically disclose generating an error statement describing the error he does disclose 
generating a log file, it is well known within modern computing systems to automate the 
generation of error reports from log files) 

As per claim 23, 

Moriconi et al ('010) discloses an interface for creating a privacy policy, comprising: 
a first portion for displaying predefined data elements;(Column 9, lines 45-50) 
a second portion for displaying groups of data elements, wherein a group of data 
elements shares at least one common property;(Figure 4) 

Moriconi et al ( c 010) does not explicitly disclose a third portion for displaying a privacy 
policy generated from the groups of data elements, Abraham et al. ('987) discloses a third 
portion for displaying a privacy policy generated from the groups of data elements.(Abstract) It 
would have been obvious to one having ordinary skill in the art at the time the invention was 
made to combine the Moriconi et al ('OlO)'s method with the Abraham et al. ('987)'s method in 
order to secure management of a computer network 

As per claim 24, 

Moriconi et al ( 4 010) discloses a computer program product, in a computer 
readable medium, for creating a privacy policy, comprising: 

instructions for moving a data element to the policy group(Figure 9) 
instructions for generating a privacy policy based on the policy group. (Figure 4) 
Moriconi et al ( c 010) does not explicitly disclose instructions for creating a policy group, 
Abraham et al. ('987) discloses instructions for creating a policy group. (Abstract) It would have 
been obvious to one having ordinary skill in the art at the time the invention was made to 
combine the Moriconi et al ('OlO)'s method with the Abraham et al. ('987)'s method in order to 
secure management of a computer network 

Conclusion 

Examiners note: Examiner has cited particular columns and line numbers in the 
references as applied to the claims above for the convenience of the applicant. Although the 
specified citations are representative of the teachings of the art and are applied to the specific 
limitations within the individual claim, other passages and figures may apply as well. It is 
respectfully requested from the applicant in preparing responses, to fully consider the references 
in entirety as potentially teaching all or part of the claimed invention, as well as the context of 
the passage as taught by the prior art or disclosed by the examiner. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to John M Winter whose telephone number is (703) 305-3971. The 
examiner can normally be reached on M-F 8:30-6, 1st Fridays off. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, James P Trammell can be reached on (703)305-9768. The fax phone numbers for the 
organization where this application or proceeding is assigned are (703) 305-7687 for regular 
communications and (703) 305-7687 for After Final communications. 

Any inquiry of a general nature or relating to the status of this application or proceeding 
should be directed to the receptionist whose telephone number is (703) 308-1 113. 



JMW 

March 2, 2 0 04 



